ABSTRACT 

Described is a system and method for providing protection of media by the 
detection of unauthorized client behaviors and the communication of the unauthorized 
client behaviors to augment the invention's detection abilities. A variety of detectors are 
sent to a client process and the responses are evaluated to detect the presence of an 
unauthorized software behavior on the client. Unauthorized behaviors include alteration 
of a client process as well as simultaneously running processes that might enable 
unauthorized copying of protected media. Communication of unauthorized software 
behaviors includes sharing of memory detectors among servers on a network, and the 
sending of memory detectors to other clients to detect previously unseen unauthorized 
behaviors on the other clients. 
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